From patchwork Sat Feb 15 09:05:51 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: gaoxu X-Patchwork-Id: 13975979 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10F99C021A0 for ; Sat, 15 Feb 2025 09:06:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 92EB36B0099; Sat, 15 Feb 2025 04:05:59 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8B896280006; Sat, 15 Feb 2025 04:05:59 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 75B0C280005; Sat, 15 Feb 2025 04:05:59 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 580C26B0099 for ; Sat, 15 Feb 2025 04:05:59 -0500 (EST) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 0B4E7C1821 for ; Sat, 15 Feb 2025 09:05:59 +0000 (UTC) X-FDA: 83121596838.30.4483E3E Received: from mta20.hihonor.com (mta20.hihonor.com [81.70.206.69]) by imf28.hostedemail.com (Postfix) with ESMTP id 7C514C000D for ; Sat, 15 Feb 2025 09:05:56 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=honor.com; spf=pass (imf28.hostedemail.com: domain of gaoxu2@honor.com designates 81.70.206.69 as permitted sender) smtp.mailfrom=gaoxu2@honor.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1739610357; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=+UG5j84zhGYC7t41WNQYDePcgLwKwWlMeeFq9ZVzv0E=; b=607GyB+2iyOUvkll0aSLHVj/zJijZ669iI9liRVHYYBQLyNEZlYSOsVxNkyrERu9yIL9XL p9Mw3TwDD2pKyhEVHzakxYfBYWfzTPE/wQG9TyMS8ayMp89iJmd7JaS7iUY6Qe+VWr++eJ UynMvRVGNVIU6I2CIWvO3f10UOssO7Q= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=honor.com; spf=pass (imf28.hostedemail.com: domain of gaoxu2@honor.com designates 81.70.206.69 as permitted sender) smtp.mailfrom=gaoxu2@honor.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1739610357; a=rsa-sha256; cv=none; b=2TvDS1br3SCU2DNBurlhf9tva8H0g2HOvCAdKpbwj/CoSPEjfXcUiX0tR6waVT21cFnin9 Jr54/fNtcUF7gYP6PvNocg4JBqY6Eed8nbt9EM6hQ6XtzluqPanwlZpcXExBuuvwCZsDUe A0C3/MWAEOQ1v43398OQpyj8J9/0/kI= Received: from w001.hihonor.com (unknown [10.68.25.235]) by mta20.hihonor.com (SkyGuard) with ESMTPS id 4Yw2zz2Qv8zYl1jK; Sat, 15 Feb 2025 17:04:47 +0800 (CST) Received: from a007.hihonor.com (10.68.22.31) by w001.hihonor.com (10.68.25.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Sat, 15 Feb 2025 17:05:51 +0800 Received: from a007.hihonor.com (10.68.22.31) by a007.hihonor.com (10.68.22.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Sat, 15 Feb 2025 17:05:51 +0800 Received: from a007.hihonor.com ([fe80::e866:83ac:f23b:c25c]) by a007.hihonor.com ([fe80::e866:83ac:f23b:c25c%10]) with mapi id 15.02.1544.011; Sat, 15 Feb 2025 17:05:51 +0800 From: gaoxu To: Andrew Morton , "linux-mm@kvack.org" CC: "linux-kernel@vger.kernel.org" , "Suren Baghdasaryan" , Barry Song <21cnbao@gmail.com>, "Yosry Ahmed" , yipengxiang Subject: [PATCH v3] mm: Fix possible NULL pointer dereference in __swap_duplicate Thread-Topic: [PATCH v3] mm: Fix possible NULL pointer dereference in __swap_duplicate Thread-Index: Adt/iIz/pSZ7Q3r8TEmsD6w3AazKUA== Date: Sat, 15 Feb 2025 09:05:51 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.164.11.140] MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 7C514C000D X-Stat-Signature: 4x8dc57ghdq6yjbutt8hcaxygiucuump X-HE-Tag: 1739610356-474099 X-HE-Meta: U2FsdGVkX19WUaFy65j0pG2q9ea1duZ6NSKiTyIpVG8Rd/eLyAy+55+jhDJT5N6hiw6gQ6O+DqgLGGkrbbHQeVOzKN6JJchmbyZICVVi/aSgODksSyok5QjWjqSrZ0FNhOdlrgA9616aKrC0ANi3TgW6ZdnEfhxEHIYEJdobBl6gZp3hyXvDpzPRbGby3YMIn7xWezseYshX8G6RJmrVmzJUNp1HlSDXmZAVJjdtmspDKRqKPkcZWQigwLXEJ5hKqozOfnDm3sBIbrL5jBBu89m82cPUK6BC94wO8mvcXOtT9EQ/QlZbw5POg+U66FfL3hxSeijvnO9bMk/3UowNeddrF+0Mknv15SW5F9xgKkFE0GqMmjtzA0LnU8cCTL4G5GPuAh1J1nXDfdYDqwihNoz6iJpRHfVmTu6m9rQPsXkJUzza3XUUq492fiQ0JEa8vMgknIL0oICJnzpwQRhMx71J+IqfN1sw2vJupHTQqqr+A9ymlP4a8asShTpMD2Hq7H8O1Y2DqEN7TrhUjs5wY94D2c+leg3Olq3kehdylc3HjU/awQuTf2cE3B1F+d+27dMukr4rEb5VJFjvUWZde3td1643EM81Y1o86mLv1SPB7R5BtgmN8Y1+XB43PtEv29LlQwFWhWToj4GGZvoSul6d3sBRuXKJZmBJR+I2yuPlOkjaUmRDB9qwAXX5ZzL5SevY0kUBcima2VJdfXBOA9SApm7OxWkYBPLFvvW9pruzFZbRF8a+C4zaRffSYkSpW/lVZacljf2qMLW6yWU5S/6w1hvegQjuY7q1ppOb7JIP7D/D1Yc6to5SlqSR0c1Ui7p62fJojZPNluNKHowu7fXKEnOghf90vVmODXN6+409UXXd60sJqkqE7a4+N9YVA6k78hy7y8WlWHP6ICtNilieI5pXUL0W2KRTKXtD6+aYc4yAdcl2TfI5xWL4jzpEcMNB3Io9QyylrRIaNMe QAOuMeiq c977bOUvsO2UTvk+qt8Z6v0TvlMJYxQPJh6WqVuA7iNna9/dFvkCDuw/Dw4dJuGtU+QJUyPZpgfW5meIgx70VAGUTTs0jlyjLLJmuXs8z7Qmzs887HuX2THNFoqtlVUTmJqob/rVyQKH6jaJ+9JRKNVfyd6QItKMkWb7Va92ZOIRlvfzwXnxvJozvdVRtV1ZoCSiGejj3+n8eFEOAN/KAkONiCFBcLhvuu6QEU/SrLpruJCBce6CWK13v9N6Yp3/2HH7mczM2mProvDECyCnLGveKQYzxm1rHs7SMaFJeYmcGSMnq7fjv6S7B81geq3GZSQ0f7P4Ujk9RxGSjXw9YNQGfy4SVkKjh3YoouOfhyWAf/7Pqj/I0MS+Cnpo4fGlIJUwc3JCyEn1sclgEA84eUHsKQuj+U0RLl/mJRpK8RlesG9XDUYKFWt0RPQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Add a NULL check on the return value of swp_swap_info in __swap_duplicate to prevent crashes caused by NULL pointer dereference. The reason why swp_swap_info() returns NULL is unclear; it may be due to CPU cache issues or DDR bit flips. The probability of this issue is very small, and the stack info we encountered is as follows： Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [RB/E]rb_sreason_str_set: sreason_str set null_pointer Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=00000008a80e5000 [0000000000000058] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Skip md ftrace buffer dump for: 0x1609e0 ... pc : swap_duplicate+0x44/0x164 lr : copy_page_range+0x508/0x1e78 sp : ffffffc0f2a699e0 x29: ffffffc0f2a699e0 x28: ffffff8a5b28d388 x27: ffffff8b06603388 x26: ffffffdf7291fe70 x25: 0000000000000006 x24: 0000000000100073 x23: 00000000002d2d2f x22: 0000000000000008 x21: 0000000000000000 x20: 00000000002d2d2f x19: 18000000002d2d2f x18: ffffffdf726faec0 x17: 0000000000000000 x16: 0010000000000001 x15: 0040000000000001 x14: 0400000000000001 x13: ff7ffffffffffb7f x12: ffeffffffffffbff x11: ffffff8a5c7e1898 x10: 0000000000000018 x9 : 0000000000000006 x8 : 1800000000000000 x7 : 0000000000000000 x6 : ffffff8057c01f10 x5 : 000000000000a318 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000006daf200000 x1 : 0000000000000001 x0 : 18000000002d2d2f Call trace: swap_duplicate+0x44/0x164 copy_page_range+0x508/0x1e78 copy_process+0x1278/0x21cc kernel_clone+0x90/0x438 __arm64_sys_clone+0x5c/0x8c invoke_syscall+0x58/0x110 do_el0_svc+0x8c/0xe0 el0_svc+0x38/0x9c el0t_64_sync_handler+0x44/0xec el0t_64_sync+0x1a8/0x1ac Code: 9139c35a 71006f3f 54000568 f8797b55 (f9402ea8) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs The patch seems to only provide a workaround, but there are no more effective software solutions to handle the bit flips problem. This path will change the issue from a system crash to a process exception, thereby reducing the impact on the entire machine. Signed-off-by: gao xu --- v1 -> v2: - Add WARN_ON_ONCE. - update the commit info. v2 -> v3: Delete the review tags (This is my issue, and I apologize). --- mm/swapfile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 7448a3876..a0bfdba94 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -3521,6 +3521,8 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage, int nr) int err, i; si = swp_swap_info(entry); + if (WARN_ON_ONCE(!si)) + return -EINVAL; offset = swp_offset(entry); VM_WARN_ON(nr > SWAPFILE_CLUSTER - offset % SWAPFILE_CLUSTER);